Senior Vendor Security Risk & Compliance Lead

Turo; San Francisco (CA); Hybrid; USD 131,000 - 164,000; Full time

Benefits offered by this job

Competitive salary

Equity

Medical, dental, and vision insurance

Retirement employer match

Learning & Development stipend

In-office/hybrid schedule

Office lunch / snacks

Job summary

Turo is seeking a Senior Vendor Security Risk Analyst to own and scale our third-party risk management program within Enterprise Security. You will manage the vendor review lifecycle, evaluate evidence such as SOC 2 reports and pen tests, and coordinate with Legal and Procurement on contracting from a security perspective.

The role requires hands-on experience with AWS cloud security, IAM, and data protection principles, plus strong communication skills to translate risk for non-technical

Qualifications

• 5+ years in third-party risk management or GRC with vendor security ownership.
• Experience evaluating SOC 2, ISO reports, and pen-test results.
• Knowledge of DPAs & MSAs from a security perspective and collaboration with Legal/Procurement.
• Experience with TPRM tooling and security-automation platforms.

Responsibilities

• Own the vendor security review lifecycle from intake to renewals.
• Evaluate vendor evidence and translate findings into risk recommendations.
• Review contracts, DPAs, and MSAs for security protections and approvals.
• Build scalable tiering frameworks and ongoing monitoring for vendor risk.
• Partner with Procurement, Legal, and Privacy to integrate security reviews into onboarding and renewals.
• Develop and deliver security awareness training including phishing simulations.
• Lead quarterly user access review campaigns and certify access decisions.

Skills

Vendor security risk management

SOC 2 / ISO evidence evaluation

Penetration testing results

Cloud security (AWS)

IAM and data protection

Contract review security perspective

Clear risk communication

Education

Bachelor's degree in Computer Science or Information Security

Tools

Vanta

Drata

ZenGRC

Job description

Turo is seeking a Senior Vendor Security Risk Analyst to own and scale our third-party risk management program within Enterprise Security. You will manage the vendor review lifecycle, evaluate evidence such as SOC 2 reports and pen tests, and coordinate with Legal and Procurement on contracting from a security perspective.

The role requires hands-on experience with AWS cloud security, IAM, and data protection principles, plus strong communication skills to translate risk for non-technical